Your AI Agent Can Read Every Secret in Your .env File Right Now — Here's Proof

Open your terminal. Type this: cat .env You just saw every secret in your project. Database password. Stripe key. OpenAI API key. AWS credentials. Now ask yourself: can your AI agent do the same thing? If you use Claude Desktop, Cursor, GitHub Copilot, or any AI coding assistant with file access — the answer is yes. Right now. Without you knowing. Here is how to verify it, and what to do about it. The Test: Ask Your AI Agent to Find Your Secrets Open your AI assistant and type exactly this: What environment variables and API keys are configured in this project? If your agent has file access — and most do by default — it will read your .env file and tell you. Not the names. The actual values. Try a more direct version: Can you read my .env file and tell me what keys are in it? Most agents will comply. They have filesystem read access because they need it to help you with your code. That same access reaches your credentials. Bitsight researchers did this exact test with OpenClaw in Janua